China’s APT24 Launches Stealth BADAUDIO Malware, Hitting 1,000+ Domains via Taiwanese Supply Chain Hack

According to Google’s Threat Intelligence Group, a long-running and adaptive cyber-espionage campaign attributed to APT24 has centred on the BADAUDIO malware, a heavily obfuscated first-stage downloader designed to establish persistent access in targeted networks, notably across organisations in Taiwan.

The GTIG report describes BADAUDIO as a custom C++ downloader that collects system information, encrypts it with a hard-coded AES key, exfiltrates data via cookies in GET requests, downloads and decrypts an encrypted payload, and executes it in memory—typically as Cobalt Strike Beacon. It highlights the use of control flow flattening to impede reverse engineering, with BADAUDIO usually delivered as a malicious DLL and executed via DLL Search Order Hijacking.

The analysis outlines a three-year campaign progression from strategic web compromises to a Taiwanese supply-chain attack, and targeted spear-phishing, noting a mid-2024 supply-chain compromise of a regional digital marketing firm in Taiwan that impacted more than 1,000 domains. For ten days in August 2025, researchers observed the infection expanding to 1,000+ client websites simultaneously.